Developer API and MCP
You can manage your actions - HTTP requests, email layouts, senders and secrets - from your own code or from an AI assistant. Workflow Transactional Email exposes a REST API and an MCP server, both managed on the Developer page inside the app.
Everything uses one credential, and both surfaces enforce the same rules: your secrets are never readable, and history is PII-masked on the way out.
The short version
Base URL
text
https://shopify.workflow-transactional-email.appAuthenticate with a bearer key created on the Developer page. Keys start with fak_ and are shown once, at creation.
Three access levels, ordered and cumulative:
| Level | Adds |
|---|---|
| Read | List and read actions, layouts, senders, secret names, history, stats |
| Read & write | Create, update and delete HTTP requests |
| Read, write & execute | Run a configured HTTP request for real |
Issue read keys by default.
A first request
Confirm a key works and see what it can do:
bash
curl https://shopify.workflow-transactional-email.app/api/v1/me \
-H "Authorization: Bearer fak_your_key_here"Related reading
- Secrets - how secrets work in the app itself.
- Make an HTTP request from Shopify Flow - the HTTP action these endpoints configure.
- History and troubleshooting - what execution history records.

